SIEM export

• Keep AtlaSent audit in the same pane of glass as your other security events.
• Trigger alerts on suspicious patterns (repeated denies, override bursts, unusual agent behavior).
• Satisfy retention requirements that are longer than AtlaSent’s default.

​

Configure

​

Event shape

{
  "source": "atlasent.audit",
  "ts": "2026-04-19T14:02:18.112Z",
  "audit_id": "aud_01HX6Z8...",
  "actor":  { "id": "agent-001", "type": "ai_agent" },
  "action": { "type": "ehr:write" },
  "target": { "id": "patient-42", "environment": "production" },
  "decision": "allow",
  "policy_id": "pol_21cfr_part11_v3",
  "permit_id": "prm_01HX6Z8...",
  "prev_hash": "b6f9a1e8c4...",
  "entry_hash": "41d73c8b2e..."
}

​

Alerting suggestions

• Repeated deny on the same actor / action class within 5 minutes. Indicates an agent ignoring authorization — possible prompt injection or bug.
• Override issued. Should always trigger a review ticket.
• Audit streaming gap > 60 seconds. SIEM export is best-effort, but the AtlaSent chain is canonical — a gap means your SIEM has drifted from truth.

​

Does SIEM export replace the signed bundle?